TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Ledger says all reports it investigated of unexpected cryptocurrency withdrawals involved devices sold through Southeast Asian reseller CryptoBilis, and confirmed an unauthorized hardware implant in at least one affected device. Researchers describe implants designed to capture wallet activity and transmit information, but the exact tampering method, number of affected devices and losses remain undisclosed.
Ledger says all user reports of unexpected cryptocurrency losses it investigated were linked to devices sold through Malaysia-based reseller CryptoBilis, and confirmed that at least one affected wallet contained an unauthorized hardware implant. The company has not said how many devices were altered or how much cryptocurrency was taken, and the precise method and timing of the tampering remain unknown.
Ledger began investigating after customers reported losing funds from wallets bought through CryptoBilis, which sells hardware wallets across Southeast Asia. On October 9, the company asked the reseller to stop selling and shipping Ledger devices. The next day, Ledger confirmed an unauthorized implant in one impacted device and said it was contacting affected users.
In a later update, Ledger said all reports of unexpected fund drains under investigation were tied to devices sold through CryptoBilis. The company described the affected volume as “limited” but did not publish a count of customers, devices or the value of the reported losses. It also said it was working with authorities to identify the person responsible.
Security researchers and online investigators have described modified Ledger Nano X devices containing added electronics. Mark Karpelès, who leads Karpeles Lab Inc. and is CTO at Shells.com, shared images of an implant concealed behind a device screen. Tibane Labs, a cryptocurrency research and development studio, said it examined two variants. Those technical findings are researchers’ analysis; Ledger has not publicly confirmed the specific components or mechanism in every affected wallet.
Risks in Reseller Wallet Purchases
The incident shows that a hardware wallet’s protection depends not only on its design but also on whether the device has remained trustworthy through its supply chain. A modified device could put a buyer at risk even when the product looks like a genuine wallet. Ledger’s confirmation of an implant makes the reports a physical-device security incident, not merely a concern about compromised websites or software.
Researchers say the examined implants could capture information displayed on the wallet and button presses, then send data over a cellular connection. If a seed phrase—the recovery information that can control a wallet’s assets—is exposed, an attacker may be able to access funds. This is a claim about the examined devices, not a finding that every CryptoBilis customer’s wallet was compromised. The amount lost and the number of people affected are not public.
The case also raises questions for authorized sellers and device return policies. Ledger has advised distributors to source products through authorized channels and not to restock returned devices. The company warns that its Genuine Check cannot detect an added implant if the original Secure Element remains intact, limiting what that check can establish about a device’s physical condition.
As an affiliate, we earn on qualifying purchases.
How the Devices Were Examined
Ledger hardware wallets are physical devices used to store private keys and authorize cryptocurrency transactions. The Nano X is one model in its product range. According to the source report, researchers began showing images of an implant in a Nano X on September 16, before Ledger’s October investigation announcement. The reported devices were sold at prices described as nearly half the price of the original hardware, though the source does not give a purchase-price comparison or establish that price as proof of tampering.
Tibane Labs said it obtained two modified devices: one bought on Amazon Japan from a China-based seller and shipped from Malaysia, and another bought through Yahoo! Auctions in Japan. Its report describes one version with a smaller replacement battery and additional circuitry, including a microcontroller, a small eSIM and an LTE module. The other, which researchers said appeared more advanced, reportedly fit beneath the display and used the original battery. These specimens do not establish that every reported device contained the same design.
Ledger has urged customers who bought a device from CryptoBilis and have not set it up to avoid starting setup. For customers who already set one up, the company advised considering a transfer of assets to a new Ledger signer with a new seed. The source report does not describe an equivalent company warning for other resellers, and Ledger said it had no indication that other resellers were shipping compromised wallets.
““One of the impacted users’ devices contained an unauthorized hardware implant.””
— Ledger
As an affiliate, we earn on qualifying purchases.
Scope and Tampering Method
Ledger has not disclosed the number of affected devices or users, the value of reported losses, or whether the confirmed implant is the same design as both versions examined by researchers. The company also has not explained when or where the devices were altered, how they entered the reseller’s inventory, or whether the affected stock came from a single shipment.
Researchers’ findings concern specific specimens obtained through separate marketplaces. The source material does not establish that all devices sold by CryptoBilis were modified, nor does it confirm that the same hardware has appeared through other sellers. Ledger said it had no indication of compromised wallets from other resellers, but that statement does not establish that every device sold elsewhere has been independently checked.
It is also unclear whether authorities have identified a suspect or what steps they may take. Ledger’s Genuine Check can verify certain aspects of device authenticity, but the company says it cannot detect an added implant when the original Secure Element remains intact. That limitation means a successful check should not be described as proof that a device has no unauthorized hardware.
As an affiliate, we earn on qualifying purchases.
Investigation and Customer Guidance
Ledger says it is contacting impacted users and working with authorities to identify the perpetrator. The company has not announced a timetable for the investigation or said when it will publish further findings. Any update on the number of affected devices, the source of the altered stock or the reported losses would help clarify the incident’s scope.
For customers who bought through CryptoBilis, Ledger’s published guidance is not to set up an unused device and, for a device already set up, to consider moving assets to a new signer with a new seed. This is company guidance, not an assurance that any individual device is compromised or safe. Users should refer to Ledger’s direct communications for instructions specific to their case and take care not to disclose recovery phrases to anyone claiming to provide support.
Ledger has also told authorized resellers and distributors to obtain products through authorized channels and avoid restocking returned units. Whether those measures will change reseller checks or return handling across the network has not been announced. The company’s investigation and any findings from authorities remain the next reported developments.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Ledger confirm?
Ledger confirmed that at least one device linked to an impacted user contained an unauthorized hardware implant. It later said all reports of unexpected fund drains it investigated involved devices sold through CryptoBilis.
Were all devices sold through CryptoBilis compromised?
No. Ledger has not said that every device sold by the reseller was altered. It described the affected volume as “limited” but has not provided a count of affected devices or customers.
What should CryptoBilis customers do?
Ledger advises customers who have not set up a device bought through CryptoBilis not to begin setup. If it has already been set up, the company says to consider moving assets to a new signer with a new seed. Customers should follow Ledger’s direct guidance and keep recovery phrases private.
Can Ledger’s Genuine Check detect the implant?
Ledger says its Genuine Check cannot detect added hardware implants when the device’s original Secure Element remains intact. A successful check should not be treated as proof that no unauthorized components have been added.
Has Ledger linked other resellers to the theft reports?
The source report says Ledger had no indication that other resellers were shipping compromised wallets. The company has not published a broad inspection result covering every seller or device.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
